apache/hadoop · error · AccessControlException

Error in {}Only kerberos based authentication is allowed.

Error message

Error in {}Only kerberos based authentication is allowed.

What it means

Error "Error in {}Only kerberos based authentication is allowed." thrown in apache/hadoop.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/datanode/DataNode.java:2420

  }

  public DataNodeDiskMetrics getDiskMetrics() {
    return diskMetrics;
  }
  
  public DataNodePeerMetrics getPeerMetrics() {
    return peerMetrics;
  }

  /** Ensure the authentication method is kerberos */
  private void checkKerberosAuthMethod(String msg) throws IOException {
    // User invoking the call must be same as the datanode user
    if (!UserGroupInformation.isSecurityEnabled()) {
      return;
    }
    if (UserGroupInformation.getCurrentUser().getAuthenticationMethod() != 
        AuthenticationMethod.KERBEROS) {
      throw new AccessControlException("Error in " + msg
          + "Only kerberos based authentication is allowed.");
    }
  }
  
  private void checkBlockLocalPathAccess() throws IOException {
    checkKerberosAuthMethod("getBlockLocalPathInfo()");
    String currentUser = UserGroupInformation.getCurrentUser().getShortUserName();
    if (!usersWithLocalPathAccess.contains(currentUser)) {
      throw new AccessControlException(
          "Can't continue with getBlockLocalPathInfo() "
              + "authorization. The user " + currentUser
              + " is not configured in "
              + DFSConfigKeys.DFS_BLOCK_LOCAL_PATH_ACCESS_USER_KEY);
    }
  }

  public long getMaxNumberOfBlocksToLog() {
    return maxNumberOfBlocksToLog;

View on GitHub (pinned to 2add963021)

Solutions

1. Enable Kerberos (hadoop.security.authentication=kerberos) for the DataNode; simple authentication is rejected for this operation.
2. Authenticate the caller with Kerberos (kinit) before invoking the operation.

When it happens

Trigger: A client or service connects to the DataNode using non-Kerberos authentication while the DataNode is configured to require Kerberos.

Common situations: A non-Kerberos authentication attempt hit a cluster in Kerberos-only mode. Configure the client for Kerberos (kinit and hadoop.security.authentication=kerberos).

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/1dc2267552354972. Report an issue: GitHub.